Real Cookie Banner
Monthly
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the WordPress plugin Real Cookie Banner: GDPR & ePrivacy Cookie Consent (all versions up to and including 5.3.5) lets unauthenticated commenters plant markup that the plugin's own render-time HTML rewriting later promotes into an executable attribute, running script in the browser of any visitor who loads the injected page. Exploitability is gated by WordPress's standard comment moderation workflow, which is why our assessment conflicts with the vendor-supplied vector: the published CVSS uses AC:L while we assess AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because the payload must survive the comment kses filter at save time and be approved for display before the plugin's page-wide regex strips the closing quote delimiter and activates it. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).